Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 18:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe
-
Size
488KB
-
MD5
fc725735982d40ae6323a4f7e51f0087
-
SHA1
379ac86039df0159e1162c6dc7d0d949611db311
-
SHA256
4dcf694e3d0a01442bab23ca47e897d73e60f859e36309948663ead9eac913bb
-
SHA512
6da8f965b74a86b0867f4b4ec6d625caeeae9eed64687810e884c57e97ac0c9b6b7b84d6e3dbc493249e97ece68bc2aade761410b9b821444943dea1acd5b4b2
-
SSDEEP
12288:/U5rCOTeiD3Tf7K7nox7TQXk4qMKuh13GucbRUHIdNZ:/UQOJDybMPIqHk1W5LN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3224 64E4.tmp 4944 6580.tmp 4204 663C.tmp 3124 66F7.tmp 2500 6784.tmp 764 683F.tmp 4304 68EB.tmp 4844 69A7.tmp 4764 6A62.tmp 540 6ADF.tmp 4348 6B7B.tmp 1768 6C47.tmp 2264 6CD3.tmp 2328 6DAE.tmp 3356 6E4A.tmp 4636 6EE6.tmp 956 6FC1.tmp 4264 7223.tmp 2440 72A0.tmp 3884 733C.tmp 1812 73B9.tmp 2592 7455.tmp 1608 7520.tmp 748 75BC.tmp 3128 7668.tmp 2532 76F5.tmp 3640 77B0.tmp 2196 782D.tmp 1108 78CA.tmp 1956 7927.tmp 2016 79F3.tmp 1208 7A7F.tmp 4188 7B1B.tmp 2372 7BA8.tmp 1404 7C25.tmp 388 7CA2.tmp 2112 7D2F.tmp 3436 7D9C.tmp 5072 7DFA.tmp 8 7E86.tmp 1808 7F03.tmp 4784 7FA0.tmp 4528 801D.tmp 3304 80B9.tmp 4728 8117.tmp 1280 81A3.tmp 2920 8220.tmp 3376 82BD.tmp 3352 833A.tmp 436 83C6.tmp 5092 8453.tmp 4476 84EF.tmp 3212 858B.tmp 872 8637.tmp 2488 86D3.tmp 4200 8741.tmp 4388 87ED.tmp 4492 8879.tmp 3124 8916.tmp 4968 89A2.tmp 2576 8A10.tmp 4932 8A7D.tmp 4304 8B19.tmp 2092 8B96.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 3224 2680 fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe 81 PID 2680 wrote to memory of 3224 2680 fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe 81 PID 2680 wrote to memory of 3224 2680 fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe 81 PID 3224 wrote to memory of 4944 3224 64E4.tmp 82 PID 3224 wrote to memory of 4944 3224 64E4.tmp 82 PID 3224 wrote to memory of 4944 3224 64E4.tmp 82 PID 4944 wrote to memory of 4204 4944 6580.tmp 83 PID 4944 wrote to memory of 4204 4944 6580.tmp 83 PID 4944 wrote to memory of 4204 4944 6580.tmp 83 PID 4204 wrote to memory of 3124 4204 663C.tmp 84 PID 4204 wrote to memory of 3124 4204 663C.tmp 84 PID 4204 wrote to memory of 3124 4204 663C.tmp 84 PID 3124 wrote to memory of 2500 3124 66F7.tmp 85 PID 3124 wrote to memory of 2500 3124 66F7.tmp 85 PID 3124 wrote to memory of 2500 3124 66F7.tmp 85 PID 2500 wrote to memory of 764 2500 6784.tmp 86 PID 2500 wrote to memory of 764 2500 6784.tmp 86 PID 2500 wrote to memory of 764 2500 6784.tmp 86 PID 764 wrote to memory of 4304 764 683F.tmp 87 PID 764 wrote to memory of 4304 764 683F.tmp 87 PID 764 wrote to memory of 4304 764 683F.tmp 87 PID 4304 wrote to memory of 4844 4304 68EB.tmp 88 PID 4304 wrote to memory of 4844 4304 68EB.tmp 88 PID 4304 wrote to memory of 4844 4304 68EB.tmp 88 PID 4844 wrote to memory of 4764 4844 69A7.tmp 89 PID 4844 wrote to memory of 4764 4844 69A7.tmp 89 PID 4844 wrote to memory of 4764 4844 69A7.tmp 89 PID 4764 wrote to memory of 540 4764 6A62.tmp 91 PID 4764 wrote to memory of 540 4764 6A62.tmp 91 PID 4764 wrote to memory of 540 4764 6A62.tmp 91 PID 540 wrote to memory of 4348 540 6ADF.tmp 92 PID 540 wrote to memory of 4348 540 6ADF.tmp 92 PID 540 wrote to memory of 4348 540 6ADF.tmp 92 PID 4348 wrote to memory of 1768 4348 6B7B.tmp 93 PID 4348 wrote to memory of 1768 4348 6B7B.tmp 93 PID 4348 wrote to memory of 1768 4348 6B7B.tmp 93 PID 1768 wrote to memory of 2264 1768 6C47.tmp 94 PID 1768 wrote to memory of 2264 1768 6C47.tmp 94 PID 1768 wrote to memory of 2264 1768 6C47.tmp 94 PID 2264 wrote to memory of 2328 2264 6CD3.tmp 95 PID 2264 wrote to memory of 2328 2264 6CD3.tmp 95 PID 2264 wrote to memory of 2328 2264 6CD3.tmp 95 PID 2328 wrote to memory of 3356 2328 6DAE.tmp 96 PID 2328 wrote to memory of 3356 2328 6DAE.tmp 96 PID 2328 wrote to memory of 3356 2328 6DAE.tmp 96 PID 3356 wrote to memory of 4636 3356 6E4A.tmp 97 PID 3356 wrote to memory of 4636 3356 6E4A.tmp 97 PID 3356 wrote to memory of 4636 3356 6E4A.tmp 97 PID 4636 wrote to memory of 956 4636 6EE6.tmp 98 PID 4636 wrote to memory of 956 4636 6EE6.tmp 98 PID 4636 wrote to memory of 956 4636 6EE6.tmp 98 PID 956 wrote to memory of 4264 956 6FC1.tmp 99 PID 956 wrote to memory of 4264 956 6FC1.tmp 99 PID 956 wrote to memory of 4264 956 6FC1.tmp 99 PID 4264 wrote to memory of 2440 4264 7223.tmp 100 PID 4264 wrote to memory of 2440 4264 7223.tmp 100 PID 4264 wrote to memory of 2440 4264 7223.tmp 100 PID 2440 wrote to memory of 3884 2440 72A0.tmp 101 PID 2440 wrote to memory of 3884 2440 72A0.tmp 101 PID 2440 wrote to memory of 3884 2440 72A0.tmp 101 PID 3884 wrote to memory of 1812 3884 733C.tmp 104 PID 3884 wrote to memory of 1812 3884 733C.tmp 104 PID 3884 wrote to memory of 1812 3884 733C.tmp 104 PID 1812 wrote to memory of 2592 1812 73B9.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\fc725735982d40ae6323a4f7e51f0087_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"23⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"24⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"25⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"26⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"27⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"28⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"29⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"30⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"31⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"32⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"33⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"34⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"35⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"36⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"37⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"38⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"39⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"C:\Users\Admin\AppData\Local\Temp\7DFA.tmp"40⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"41⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"42⤵
- Executes dropped EXE
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"43⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"44⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"45⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8117.tmp"C:\Users\Admin\AppData\Local\Temp\8117.tmp"46⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"47⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"48⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"49⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"50⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"51⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"52⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"53⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"54⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"55⤵
- Executes dropped EXE
PID:872 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"56⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"57⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"58⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"59⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"60⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"61⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"62⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"63⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"64⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"65⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"66⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"67⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"68⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"C:\Users\Admin\AppData\Local\Temp\8DD8.tmp"69⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"70⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"71⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"72⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"73⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"74⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"75⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"76⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\9163.tmp"C:\Users\Admin\AppData\Local\Temp\9163.tmp"77⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"78⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"79⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"80⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"81⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"82⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"83⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"84⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"85⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"86⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\9654.tmp"C:\Users\Admin\AppData\Local\Temp\9654.tmp"87⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"88⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"89⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"90⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"91⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"92⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"93⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"94⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"95⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"96⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"97⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"98⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"99⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"100⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"101⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"102⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"103⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\9E72.tmp"C:\Users\Admin\AppData\Local\Temp\9E72.tmp"104⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"105⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"C:\Users\Admin\AppData\Local\Temp\9F4D.tmp"106⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"107⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"108⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"109⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"110⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"111⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"112⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"113⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"114⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"115⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"116⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"117⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"118⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"119⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"120⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"121⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"122⤵PID:216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-